The European Commission has introduced a bold initiative to enhance cybersecurity in the healthcare sector, addressing the increasing number of cyberattacks on hospitals and health organizations throughout Europe.

With half of Europe's hospitals experiencing cyberattacks, Health Commissioner Oliver Varhelyi and Commission President Ursula von der Leyen have prioritized cybersecurity for their second term, aiming to address the issue within 100 days.

Announced on Wednesday, the plan suggests establishing a Cybersecurity Support Centre within the European Union Agency for Cybersecurity (ENISA).

This center will offer tailored cybersecurity assistance to healthcare organizations to reduce the impact of increasingly sophisticated attacks.

A major concern is the surge in ransomware, responsible for over 50% of healthcare cyberattacks between 2021 and 2023.

Such attacks often compel healthcare institutions to pay ransoms to regain access to crucial systems, jeopardizing patient care and safety.

Alongside the support center, the plan involves developing cybersecurity training resources for healthcare professionals and creating a warning service by 2026 to alert the sector to emerging threats. It also emphasizes a coordinated European response to large-scale cyber incidents through the Cyber Solidarity Act's EU Cybersecurity Reserve, which would offer technical aid, coordination, and financial support to EU member states.

The Commission is also urging EU countries to financially support the initiative, proposing the creation of 'Cybersecurity Vouchers' to help smaller healthcare organizations enhance their cyber defenses.

These vouchers would follow the model of 'innovation vouchers' previously used to assist SMEs.

Moreover, the Commission is advocating for countries to mandate that healthcare entities report ransom payments, a contentious issue due to many institutions' reluctance to reveal such payments, potentially hindering ongoing investigations.

Even though healthcare institutions are already subject to EU cyber regulations, like the NIS2 Directive, which establishes cybersecurity and reporting standards for critical sectors, the Commission pointed out that many member states have delayed incorporating these regulations into national law.

Healthcare is also affected by the Cyber Resilience Act (CRA), which establishes standards for the cybersecurity of products, including software in medical devices.

The Commission's new action plan intends to provide a comprehensive structure to detect, respond to, and recover from cyber threats in the healthcare sector, while promoting increased collaboration and resource-sharing throughout the EU. A public consultation on the plan is anticipated, with a non-binding recommendation expected by the end of 2025.

Healthcare is a key focus for cybercriminals, drawn by the sector's high risks, where successful attacks can have dire consequences.

However, many healthcare institutions face challenges with cybersecurity due to limited resources and a shortage of specialized staff, resulting in vulnerabilities that cybercriminals can exploit.

As the Commission strives to bolster cybersecurity protections for this crucial sector, the plan seeks to create a safer environment for patients and healthcare providers alike.